{"record":{"id":"9bee6e9e6e967386","repo":"multica-ai/multica","slug":"agent-execution-context-requires-multica-token-to-9bee6e","errorCode":null,"errorMessage":"agent execution context requires MULTICA_TOKEN to be a task-scoped mat_ token","messagePattern":"agent execution context requires MULTICA_TOKEN to be a task-scoped mat_ token","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/cmd/multica/cmd_auth.go","lineNumber":473,"sourceCode":"\tif cfg.AppURL == \"\" && serverURL == defaultCloudServerURL {\n\t\tcfg.AppURL = defaultCloudAppURL\n\t}\n\tif err := cli.SaveCLIConfigForProfile(cfg, profile); err != nil {\n\t\treturn fmt.Errorf(\"failed to save config: %w\", err)\n\t}\n\n\tfmt.Fprintf(os.Stderr, \"Authenticated as %s (%s)\\nToken saved to config.\\n\", me.Name, me.Email)\n\treturn nil\n}\n\nfunc runAuthStatus(cmd *cobra.Command, _ []string) error {\n\tif err := requireTaskLocalConfigRoot(); err != nil {\n\t\treturn err\n\t}\n\ttaskContext := inDaemonManagedExecutionContext()\n\ttoken := resolveToken(cmd)\n\tif taskContext && !strings.HasPrefix(token, \"mat_\") {\n\t\treturn fmt.Errorf(\"agent execution context requires MULTICA_TOKEN to be a task-scoped mat_ token\")\n\t}\n\tserverURL := resolveServerURL(cmd)\n\n\tif token == \"\" {\n\t\tfmt.Fprintln(os.Stderr, \"Not authenticated. Run 'multica login' to authenticate.\")\n\t\treturn nil\n\t}\n\n\tclient := cli.NewAPIClient(serverURL, \"\", token)\n\n\tctx, cancel := cli.APIContext(context.Background())\n\tdefer cancel()\n\n\tvar me struct {\n\t\tName  string `json:\"name\"`\n\t\tEmail string `json:\"email\"`\n\t}\n\tif err := client.GetJSON(ctx, \"/api/me\", &me); err != nil {","sourceCodeStart":455,"sourceCodeEnd":491,"githubUrl":"https://github.com/multica-ai/multica/blob/2c0912b6ec764b373d44eeea1e80f0d9f11ab417/server/cmd/multica/cmd_auth.go#L455-L491","documentation":"`multica auth status` detects daemon-managed agent execution (inDaemonManagedExecutionContext). In that context the credential must be a task-scoped mat_ token — the daemon deliberately provisions per-task tokens. If the resolved token has any other prefix (mul_, cloud PAT, empty-but-set env), status refuses to run to surface credential-plumbing bugs.","triggerScenarios":"MULTICA_TOKEN set to a human PAT (mul_...) inside an agent task; the daemon's token injection missing/overridden so a personal token leaks into the task env; manually exporting a user token while running under the daemon.","commonSituations":"Developers debugging inside a chat task and exporting their own credentials; misconfigured daemon templates that copy user config into task env; version skew between daemon and CLI on token scoping.","solutions":["Unset the manual override: `unset MULTICA_TOKEN` and let the daemon inject the task-scoped mat_ token","Verify with the daemon operator/template that tasks receive mat_ tokens","Update daemon and CLI to matching versions if token scoping changed recently","To use human credentials, run the CLI outside the daemon-managed execution context"],"exampleFix":"# before (inside a chat task)\nexport MULTICA_TOKEN=mul_personal...\nmultica auth status   # -> agent execution context requires mat_\n\n# after\nunset MULTICA_TOKEN\nmultica auth status","handlingStrategy":"validation","validationCode":"# inside daemon-managed tasks, assert the token scope\ncase \"${MULTICA_TOKEN:-}\" in mat_*) ;; *) echo 'MULTICA_TOKEN must be a mat_ task token here' >&2; exit 1;; esac","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never export personal credentials inside chat-task sessions; rely on daemon injection","Keep daemon and CLI versions aligned so task token scoping stays consistent"],"tags":["cli","auth","token","agent-context","configuration"],"backgroundTag":null,"analyzedSha":"2c0912b6ec764b373d44eeea1e80f0d9f11ab417","analyzedAt":"2026-08-15T13:25:18.241Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}